package.json: remove qs dependency

doesn't seem to be used anywhere in Express. it is, however, used in Connect and should be updated there. right now, it uses an older version.